Explain Common Threats and Vulnerabilities 100-160 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which social engineering attack involves an attacker calling a help desk and pretending to be an employee to obtain a password reset?

   • APhishing
   • BTailgating
   • CVishing
   • DSmishing
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a potential security impact of a compromised IoT device in a home network?

   • AIt has no impact because IoT devices lack internet access
   • BIt can be used as part of a botnet to launch DDoS attacks
   • CIt can only affect the device itself, not other devices
   • DIt only causes physical damage to the device
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's e-commerce site is experiencing intermittent outages during peak hours. The security team finds that the site is receiving a high volume of legitimate-looking HTTP requests from many different IP addresses, but the requests are for a single expensive search endpoint. The requests are not malicious in content, but they are overwhelming the backend. Which type of attack is this, and what is the most effective mitigation?

   • ABotnet; block the IP addresses
   • BVolumetric DDoS; increase bandwidth
   • CSmishing; enable web application firewall (WAF)
   • DApplication-layer DDoS; implement rate limiting and CAPTCHA on the endpoint
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst notices that many IoT devices in a botnet are sending traffic to a single target server. The analyst wants to explain to management how the botnet was likely created. Which statement accurately describes a common method?

   • AThe devices were overloaded with traffic until they joined the botnet
   • BThe devices were infected by malware that connected them to a command-and-control server
   • CThe devices were tricked into visiting a phishing website
   • DThe devices were physically stolen and reconfigured by the attacker
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has implemented email filtering and user awareness training to reduce phishing. However, an attacker successfully tricks an employee into revealing their password over the phone by pretending to be from IT support. Which additional control would be most effective in preventing this type of attack?

   • ABlock all incoming phone calls from unknown numbers
   • BImplement multi-factor authentication (MFA) for all accounts
   • CDisable the employee's account immediately
   • DIncrease the frequency of phishing simulations
   Reveal Solution Discussion Select an answer first